ipsec-types: Support the %unique mark value

man/ipsec.conf.5.in

@@ -987,7 +987,9 @@ sets an XFRM mark in the inbound and outbound
 IPsec SAs and policies. If the mask is missing then a default
 mask of
 .B 0xffffffff
-is assumed.
+is assumed. The special value
+.B %unique
+assigns a unique value to each newly created IPsec SA.
 .TP
 .BR mark_in " = <value>[/<mask>]"
 sets an XFRM mark in the inbound IPsec SA and

src/libstrongswan/ipsec/ipsec_types.c

@@ -48,7 +48,15 @@ bool mark_from_string(const char *value, mark_t *mark)
 	{
 		return FALSE;
 	}
-	mark->value = strtoul(value, &endptr, 0);
+	if (strcasepfx(value, "%unique"))
+	{
+		mark->value = MARK_UNIQUE;
+		endptr = (char*)value + strlen("%unique");
+	}
+	else
+	{
+		mark->value = strtoul(value, &endptr, 0);
+	}
 	if (*endptr)
 	{
 		if (*endptr != '/')

src/swanctl/swanctl.opt

@@ -622,9 +622,10 @@ connections.<conn>.children.<child>.reqid = 0
 connections.<conn>.children.<child>.mark_in = 0/0x00000000
 	Netfilter mark and mask for input traffic.
 
-	Netfilter mark and mask for input traffic. On Linux Netfilter may apply
+	Netfilter mark and mask for input traffic. On Linux Netfilter may require
-	marks to each packet coming from a tunnel having that option set. The
+	marks on each packet to match an SA having that option set. This allows
-	mark may then be used by Netfilter to match rules.
+	Netfilter rules to select specific tunnels for incoming traffic. The
+	special value _%unique_ sets a unique mark on each CHILD_SA instance.
 
 	An additional mask may be appended to the mark, separated by _/_. The
 	default mask if omitted is 0xffffffff.
@@ -634,7 +635,8 @@ connections.<conn>.children.<child>.mark_out = 0/0x00000000
 
 	Netfilter mark and mask for output traffic. On Linux Netfilter may require
 	marks on each packet to match a policy having that option set. This allows
-	Netfilter rules to select specific tunnels for outgoing traffic.
+	Netfilter rules to select specific tunnels for outgoing traffic. The
+	special value _%unique_ sets a unique mark on each CHILD_SA instance.
 
 	An additional mask may be appended to the mark, separated by _/_. The
 	default mask if omitted is 0xffffffff.